CVE-2026-18632

MEDIUM 6.3

langgenius dify Jinja2 jinja2_transformer.py jinja2.Template special elements used in a template engine

CVSS Score

6.3

EPSS Score

0.0%

EPSS Percentile

0th

A security flaw has been discovered in langgenius dify up to 1.14.2. This issue affects the function jinja2.Template of the file api/core/helper/code_executor/jinja2/jinja2_transformer.py of the component Jinja2 Handler. The manipulation results in improper neutralization of special elements used in a template engine. The attack may be launched remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

CWE	CWE-1336 CWE-791
Vendor	langgenius
Product	dify
Published	Aug 3, 2026
Last Updated	Aug 3, 2026

Stay Ahead of the Next One

Get instant alerts for langgenius dify

Be the first to know when new medium vulnerabilities affecting langgenius dify are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Scope

Confidentiality

Integrity

Availability

Affected Versions

langgenius / dify

1.14.0 1.14.1 1.14.2

References

NVD ↗ CVE.org ↗ EPSS Data ↗

vuldb.com: https://vuldb.com/vuln/385555 vuldb.com: https://vuldb.com/vuln/385555/cti vuldb.com: https://vuldb.com/cve/CVE-2026-18632 vuldb.com: https://vuldb.com/submit/853188 github.com: https://github.com/CVE-Hunter-Leo/CVE/issues/14

Credits

🔍 CW.Wong (VulDB User) VulDB CNA Team